Test Kennung:	1.3.6.1.4.1.25623.1.1.10.2022.0088
Kategorie:	Mageia Linux Local Security Checks
Titel:	Mageia: Security Advisory (MGASA-2022-0088)
Zusammenfassung:	The remote host is missing an update for the 'docker-containerd' package(s) announced via the MGASA-2022-0088 advisory.
Beschreibung:	Summary: The remote host is missing an update for the 'docker-containerd' package(s) announced via the MGASA-2022-0088 advisory. Vulnerability Insight: A bug was found in containerd where containers launched through containerd's CRI implementation with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information. Kubernetes and crictl can both be configured to use containerd's CRI implementation. (CVE-2022-23648) Affected Software/OS: 'docker-containerd' package(s) on Mageia 8. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2022-23648 https://github.com/containerd/containerd/security/advisories/GHSA-crp2-qrr5-8pq7 Debian Security Information: DSA-5091 (Google Search) https://www.debian.org/security/2022/dsa-5091 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUDQUQBZJGBWJPMRVB6QCCCRF7O3O4PA/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HFTS2EF3S7HNYSNZSEJZIJHPRU7OPUV3/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCCARJ6FU4MWBTXHZNMS7NELPDBIX2VO/ https://security.gentoo.org/glsa/202401-31 http://packetstormsecurity.com/files/166421/containerd-Image-Volume-Insecure-Handling.html https://github.com/containerd/containerd/commit/10f428dac7cec44c864e1b830a4623af27a9fc70 https://github.com/containerd/containerd/releases/tag/v1.4.13 https://github.com/containerd/containerd/releases/tag/v1.5.10 https://github.com/containerd/containerd/releases/tag/v1.6.1
Copyright	Copyright (C) 2022 Greenbone AG

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.